Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication
SpecterOps researchers demonstrated that NTLM relay attacks can bypass LDAP and SMB signing through re-authentication on attacker-owned connections — undermining a mitigation many enterprises have relied on for years until Microsoft's recent fix.
Summary written by editorial AI · Source link below
For years, we thought LDAP and SMB signing protected us from NTLM relay attacks. However, we found that both protocols could be relay targets through re-authentication on a connection the attacker already owned. Signing was still enforced, just with the attacker known session key. Microsoft fixed SMB quietly in September 2026 and LDAP in October […] The post Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication appeared first on SpecterOps .
Editorial Analysis
Many European enterprises still depend on NTLM in hybrid AD environments; learning that signing alone did not prevent relay attacks should accelerate NTLM phase-out and patch verification.
Confirm deployment of Microsoft's fix for the LDAP signing bypass and add NTLM deprecation milestones to your identity roadmap.
A newly disclosed technique bypassed NTLM relay protections that enterprises have trusted for years — the fix is available but NTLM phase-out should be accelerated.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at SpecterOps in a new tab.
More from the Research Desk
- Firecracker VM Escape: PwnEscape Part 23d
- A Gingerbread House for LLM Agents: Source-Planned Honeypots That Lure Autonomous Attackers into an Isolated Shadow3d
- LABBA: LLM-Assisted Behavioral Biometric Authentication3d
- A Cyber Range Evaluation of Inductive Autonomous Network Incident Response Agents3d
- KeHoSu: Keyed Homoglyph Substitution for Authenticated Text Provenance over Copy-Paste Channels3d